A factual overview of controls for web delivery, lead acceptance, access, secrets, dependency checks and recovery. It is not a certification or universal security guarantee.
The platform uses HTTPS, restrictive response headers, strict input allow-lists, a transactional lead store, least-privilege runtime roles and secrets outside application artifacts. These controls reduce risk but do not replace independent review.
Diagnostic requests are limited to 64 KB, validated against an exact schema and accepted only after a Postgres commit. CRM and email outages are isolated through an outbox. Raw IPs, request bodies and provider errors are prohibited from application logs.
Production deploys are restricted to protected `main`, pinned SSH host keys and an explicit GO variable. Runtime secrets live outside the mutable artifact; database migration credentials are short-lived and are not reused by the application.
MASLOV Solutions does not claim ISO, SOC, PCI or another certification. Vendor controls, monitoring, backups and recovery require continuous verification. Report a suspected vulnerability to security@maslov.solutions without sending personal or client data.
Security statements map to tracked configuration, tests or a stated limitation. A control that cannot be evidenced is not presented as active.
The next step
Use the contact route; do not submit vulnerabilities or secrets through the diagnostic form.
